Research map / Point clouds / Point cloud classification
PointCVaR: Risk-Optimized Outlier Removal for Robust 3D Point Cloud Classification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PointCVaR, an outlier removal method that scores points by gradient-based risk from a trained classifier and removes high-tail-risk points via a CVaR-minimizing linear program (approximated by risk sorting), defending against random, adversarial and backdoor point outliers.
Problem
Point cloud classifiers are vulnerable to noisy points (random background noise, adversarial point addition, backdoor triggers), while existing outlier removal methods are handcrafted or learned without considering the downstream classification task.
Approach
Define point risk as the gradient norm of the classifier score with respect to point features (averaged over layers), observe that noise points inflate the tail (CVaR) of the point risk distribution, and recast outlier removal as minimizing CVaR via a linear program with binary weights, approximated by sorting in O(N).
Key results
- Multi-step PointCVaR achieves above 80% accuracy against backdoor attacks across all models and datasets, where baselines such as SOR and PCN fail on many backdoor settings (e.g., PCN 4.1% on PL MN with PointNet, SOR 10.0% on PL SN with DGCNN).
- As a plugin, vanilla PointCVaR raises PGD (MN) accuracy under adversarial noise to about 80% on average and improves PCM (MN) CD accuracy from 2.8% to 89.8%.
- Vanilla PointCVaR improves DGCNN accuracy on PL (MN) from 4.1% (raw) to 83.7%, with multi-step reaching 88.6%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use multi-step rather than vanilla PointCVaR removal | PointCVaR on ModelNet40 · Global random outliers | accuracy (%): 89.1 -> 89.6 | Helped |
| Use multi-step rather than vanilla PointCVaR removal | PointCVaR on ModelNet40 · Chamfer divergence attack | accuracy (%): 84.0 -> 80.0 | Hurt |
| Add PointCVaR as a preprocessing plugin | DUP-Net on ModelNet40 · Shape-invariant attack | accuracy (%): 40.1 -> 81.7 | Helped |
| Add PointCVaR as a preprocessing plugin | PointCutMix on ModelNet40 · Chamfer divergence attack | accuracy (%): 2.8 -> 89.8 | Helped |
| Add PointCVaR as a preprocessing plugin | PGD adversarial training on ShapeNet · Shape-invariant attack | accuracy (%): 31.6 -> 94.5 | Helped |
| Add the geometric score (λ=1.0) (ablation) | Vanilla PointCVaR · ModelNet40, global random outliers | accuracy (%): 59.5 -> 82.4 | Helped |
| Add the geometric score (λ=1.0) (ablation) | Multi-step PointCVaR · ModelNet40, poison-label backdoor | accuracy (%): 84.2 -> 85.7 | Helped |
| Use cross-entropy rather than maximum output logits as the classification score (ablation) | Vanilla PointCVaR · ModelNet40, global random outliers | accuracy (%): 76.7 -> 82.4 | Helped |
| Use cross-entropy rather than sum of output logits as the classification score (ablation) | Vanilla PointCVaR · ModelNet40, global random outliers | accuracy (%): 77.2 -> 82.4 | Helped |
| Use cross-entropy rather than maximum output logits as the classification score (ablation) | Vanilla PointCVaR · ModelNet40, Chamfer divergence attack | accuracy (%): 88.5 -> 88.7 | No clear effect |
| Add multi-layer point features to risk calculation (ablation) | Vanilla PointCVaR · ModelNet40, global random outliers | accuracy (%): 81.4 -> 82.4 | Helped |
| Add multi-layer point features to risk calculation (ablation) | Vanilla PointCVaR · ModelNet40, Chamfer divergence attack | accuracy (%): 88.3 -> 88.7 | No clear effect |
Surprising findings
- Statistical outlier removal and PointCleanNet are reported to fail on backdoor triggers, with some settings near chance accuracy (e.g., 10.0%).
- Multi-step removal over-removes clean points at low retention rates, reducing clean accuracy (about 85% at delta=0.95 vs 88.5% for vanilla).
Limitations
- Multi-step removal over-removes clean points when retention rate is low, hurting clean accuracy.
- Backdoor removal requires a higher number of iterations I, adding linear computational cost.
- Linear programming solution is polynomial in complexity, so the O(N) sorting approximation is used instead.
Experimental setup
Datasets: ModelNet40 ShapeNet
Benchmarks: ModelNet40 ShapeNet
Metrics: classification accuracy
Baselines: Random Sampling Radius Outlier Removal Statistical Outlier Removal PointCleanNet DUP-Net PointCutMix PGD adversarial training
Builds on: PointCleanNet DUP-Net PointCutMix PGD adversarial training
Closest papers by meaning
- CausalPC: Improving the Robustness of Point Cloud Classification by Causal Effect Identification (CVPR 2024 · similarity 0.88)
- PO3AD: Predicting Point Offsets toward Better 3D Point Cloud Anomaly Detection (CVPR 2025 · similarity 0.88)
- Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective (NeurIPS 2024 · similarity 0.87)
- ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration (ICLR 2025 · similarity 0.87)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.87)
- Point Cloud Upsampling Using Conditional Diffusion Module with Adaptive Noise Suppression (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.